If you do one thing this week, log in to every Synology NAS you own and confirm DSM is fully updated. Synology says ransomware crews are actively exploiting an old, already patched flaw on NAS units running outdated DSM, and for most small offices that box holds the file shares and the backups. A NAS that was set up years ago and never touched again is exactly what these attackers are looking for.
Patch now
| Product | Issue | Action |
|---|---|---|
| Synology NAS (DSM) | C3RB3R ransomware exploiting outdated DSM | Update DSM, enable automatic updates, remove internet exposure |
| WordPress Core | CVE-2026-119977: unauthenticated code execution during upgrades, on CISA KEV | Confirm 7.1.4 or your branch’s patched release |
| Zyxel GS1900 switches | CVE-2026-107441: unauthenticated command execution from the LAN, exploited | Install the .3 firmware for your model |
| Ivanti Connect Secure | CVE-2026-111357 and CVE-2026-118527: chained zero-days, on CISA KEV | Upgrade to 25.1.1.3 or 22.8R2.6, then hunt for compromise |
Synology DSM: C3RB3R ransomware
What it is: Synology warned customers that attackers are exploiting a vulnerability it fixed in advisory Synology-SA-24:20 to encrypt data on NAS devices running old DSM versions. According to The Hacker News, that advisory covers CVE-2024-10441 (CVSS 9.8), CVE-2024-50629, and CVE-2024-10445. The same report cites Qihoo 360 research saying C3RB3R also used two flaws Synology fixed in September 2026, CVE-2026-13684 and CVE-2026-13639. Encrypted files get a .L0CK3D extension and a read-me3.txt ransom note.
Who is affected: Any Synology NAS that has fallen behind on DSM updates, especially one reachable from the internet.
What to do:
- Update DSM to the latest release for your model. The minimum builds for the SA-24:20 fixes are 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. Going to the current release also picks up the September 2026 fixes.
- Turn on automatic DSM updates, as Synology recommends.
- Remove port forwards to DSM and stop publishing the admin interface to the internet. Use a VPN for remote access.
- Make sure at least one backup copy is not on the same NAS and cannot be deleted from it: immutable cloud storage or an offline copy.
WordPress Core (CVE-2026-119977)
What it is: A race condition in WordPress Core rated CVSS 8.1. During a full core update, an unauthenticated attacker can execute code on the server in the short window while files are staged. WordPress fixed it in 7.1.4 on October 28 and backported the fix to branches through 4.7, per SecurityWeek. CISA added it to the KEV catalog on November 3 with a November 6 deadline for federal agencies (The Hacker News). Wordfence logged more than 18,500 requests against staged setup-config.php paths in the first 21 hours, though it has not reported a successful compromise.
What to do: Check the version under Dashboard, Updates on every site you own, including old campaign or landing page sites. Do not assume your host already did it. Look in web server logs for requests to setup-config.php paths since October 28.
Zyxel GS1900 switches (CVE-2026-107441)
What it is: An out-of-bounds write in the switch web interface that lets an unauthenticated attacker on the LAN run OS commands, per the Zyxel advisory. Zyxel’s advisory does not mention exploitation, but BleepingComputer reports GreyNoise found 996 compromised devices in 48 countries, with configurations and hashed root credentials stolen.
Who is affected: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, and 48HPv2 on firmware 2.90(xxxx.2)C0 and earlier.
What to do: Install the 2.90(xxxx.3)C0 firmware for your model, for example 2.90(AAHL.3)C0 on a GS1900-24. Put switch management on a dedicated VLAN that user devices and guest Wi-Fi cannot reach. If a switch was ever reachable from an untrusted network, review its configuration and change the admin password after patching.
Ivanti Connect Secure (CVE-2026-111357, CVE-2026-118527)
What it is: Two more flaws that attackers chained with October’s CVE-2026-104935 to gain root without logging in, even on appliances that had the October fix. CISA added both to KEV on October 30 (SecurityWeek).
What to do: Upgrade 25.1.1.2 and earlier to 25.1.1.3, or 22.8R2.5 and earlier to 22.8R2.6. Then investigate for compromise. Rapid7 says this activity evades Ivanti’s Integrity Checker Tool, so a clean scan does not prove anything. Preserve logs before rebooting and rotate credentials that passed through the appliance.
Other items this week
Device code phishing using fake AI and tech event invites
What it means: BleepingComputer reports a campaign using fake OpenAI, SpaceX, and Anthropic event invitations that require a work account sign-in. Microsoft users are tricked into entering a device code, which hands the attacker a valid token without stealing a password. Google users are sent through a proxy page that steals the session cookie. Push or SMS MFA does not stop either, because the victim completes the sign-in.
What to do: Block device code flow in Entra Conditional Access for everyone who does not need it, which is nearly every office user. Move admins and finance staff to phishing-resistant MFA such as FIDO2 security keys or passkeys. Tell staff that no legitimate event registration asks them to type a code into a Microsoft sign-in page. Our cybersecurity services cover this Conditional Access and MFA work.
Windows 11 23H2 Enterprise and Education: end of updates November 10
What it means: Microsoft’s Windows IT Pro roundup confirms 23H2 Enterprise and Education editions get their last update on November 10, 2026. Devices left on 23H2 stop receiving security fixes after that Patch Tuesday. The same post notes Intune ends CNAME-based auto-discovery for Windows MDM-only enrollment on January 15, 2027, and that Windows Update certificates expire in May and June 2027.
What to do: Pull a version report from Intune or your RMM tool and move any 23H2 Enterprise or Education device to a supported version such as 25H2. Keep every supported device current, since Microsoft’s certificate rotation guidance says outdated devices will lose Windows Update access until they install a required update. If you need help keeping patch levels in check, that is part of our managed IT services.
This week’s checklist
- Log in to each Synology NAS, update DSM to the current release, enable automatic updates, and confirm no router port forward points at it.
- Check every WordPress site you own for 7.1.4 or your branch’s patched release.
- Inventory Zyxel GS1900 switches and confirm each runs .3 firmware, with management limited to a dedicated VLAN.
- If you run Ivanti Connect Secure, confirm 25.1.1.3 or 22.8R2.6 and start a compromise review.
- Create an Entra Conditional Access policy that blocks device code flow, with only documented exceptions.
- Run a Windows version report and schedule upgrades for anything on 23H2 Enterprise or Education.
Ransomware that targets the NAS is built to take away your recovery options along with your files. If your only backup lives on the same device it protects, or you have never tested a full restore, our backup and disaster recovery service sets up immutable copies and verified restores, and our network infrastructure work handles VLAN segmentation for switch and NAS management.
